diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ae1c550..0a35b4f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,10 @@ updates:
       day: monday
     open-pull-requests-limit: 5
     labels: ["dependencies", "github-actions"]
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   - package-ecosystem: npm
     directory: /
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 486d81b..1bafba3 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,11 +32,11 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
       - name: Analyze
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:${{ matrix.language }}
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 2b06de7..52baef3 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -20,7 +20,7 @@ license: <https://github.com/microsoft/vscode-languageserver-node>
 
 ## MessagePack for Python
 
-The Python runtime depends on `msgpack` version `1.2.1`, distributed under the
+The Python runtime depends on `msgpack` version `1.2.2`, distributed under the
 Apache License 2.0. Source and license:
 <https://github.com/msgpack/msgpack-python>
 
diff --git a/docs/architecture-and-operations.md b/docs/architecture-and-operations.md
index 4f33770..20dab1f 100644
--- a/docs/architecture-and-operations.md
+++ b/docs/architecture-and-operations.md
@@ -230,7 +230,7 @@ A production monitor should distinguish:
 - Node.js: 20 and newer, continuously tested on 20, 22, and 24.
 - Python: 3.11 and newer, continuously tested on 3.11 through 3.14.
 - Microsoft dev-tunnels SDK: pinned to 1.3.50.
-- MessagePack Python: pinned to 1.2.1.
+- MessagePack Python: pinned to 1.2.2.
 - RPC protocol: observed version 5 only.
 
 The VS Code Remote RPC interface is private and can change without semantic
diff --git a/pyproject.toml b/pyproject.toml
index 3fcb56d..c615689 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -10,7 +10,7 @@ readme = "README.md"
 requires-python = ">=3.11"
 license = "MIT"
 authors = [{ name = "John Osumi" }]
-dependencies = ["msgpack==1.2.1"]
+dependencies = ["msgpack==1.2.2"]
 
 [project.scripts]
 remote-ssh-tunnel-rpc = "remote_ssh_tunnel.cli:main"
diff --git a/requirements.txt b/requirements.txt
index 5e4913b..9258cbe 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1 +1 @@
-msgpack==1.2.1
+msgpack==1.2.2
diff --git a/scripts/validate_repository.py b/scripts/validate_repository.py
index c3b7109..7b665c4 100755
--- a/scripts/validate_repository.py
+++ b/scripts/validate_repository.py
@@ -151,8 +151,10 @@ def check_runtime_contract(errors: list[str]) -> None:
         errors.append("relay executable is not marked executable")
 
     requirement = (ROOT / "requirements.txt").read_text().strip()
-    if requirement != "msgpack==1.2.1":
-        errors.append("requirements.txt must pin the audited msgpack runtime")
+    pyproject = (ROOT / "pyproject.toml").read_text()
+    pinned = re.search(r'"((?:msgpack==)[0-9][0-9.]*)"', pyproject)
+    if pinned is None or requirement != pinned.group(1):
+        errors.append("requirements.txt must pin the same msgpack version as pyproject.toml")
 
 
 def check_plist(errors: list[str]) -> None: